CVE-2026-74468

In the Linux kernel, the following vulnerability has been resolved: gpio: pch: use rawspinlockt for the register lock pchirqtype is registered as the irqchip .irqsettype callback and takes chip-spinlock with spinlockirqsave. This callback is reached from setupirq - irqsettrigger - chip-irqsettype...

CVE-2026-74506

In the Linux kernel, the following vulnerability has been resolved: afs: Fix UAF when sending a message In afsmakecall, there's a race with async call reception and destruction. If a call is dispatched that doesn't have call-writeiter set used to specify the data content for FS.StoreData, then th...

CVE-2026-74546

In the Linux kernel, the following vulnerability has been resolved: hwmon: adt7470 Fix divide-by-zero TOCTOU crash in fan speed read If the fan data becomes 0 between the FANDATAVALID check and the FANPERIODTORPM conversion, it will result in a divide-by-zero crash due to a race with a concurrent...

CVE-2026-74543

In the Linux kernel, the following vulnerability has been resolved: net: udptunnel: fix memory leak in udptunnelnicunregister syzbot reported a memory leak 1 in the UDP tunnel NIC offload code. When device registration fails e.g. in registernetdevice, netdev core unwinds by sending a single...

CVE-2026-74489

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tidtx use-after-free on BA session stop ieee80211stoptxbacb hands tidtx to kfreercu through ieee80211removetidtx, and then reads tidtx-ndp after dropping sta-lock: ieee80211removetidtxsta, tid; / kfreercutidtx...

CVE-2026-74486

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: use exefiledenywriteaccess for the interpreter clone For MISCFMTOPENFILE entries loadmiscbinary clones the registered interpreter file and denies write access to the clone via plain denywriteaccess. The clone is...

CVE-2026-74503

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRVTIMERIFLGDEAD once the close completes sndtimercloselocked marks an instance with SNDRVTIMERIFLGDEAD and returns early when the flag is already set, but the flag is never cleared again. A completed close...

UBUNTU-CVE-2026-74446

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold eventmutex while checkpointing CRIU events kfdcriucheckpointevents counts the entries in p-eventidr via kfdgetnumevents, allocates an array sized to that count, and then walks the same IDR to fill it. Neither the...

UBUNTU-CVE-2026-74461

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave pointer In i2cimxunregslave, the slave pointer is set to NULL after disabling interrupts. However, a pending interrupt might already have started the hrtimer i2cimxslavetimeout befor...

UBUNTU-CVE-2026-74513

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmbnode in loopback attach/detach/unregister dibsloattachdmb, dibslodetachdmb and dibslounregisterdmb look up the dmbnode under dmbhtlock, drop the lock and only then operate on the node's refcount...

UBUNTU-CVE-2026-74443

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: bound DMA command body size against suffix pointer vmwcmddma locates the DMA suffix at unsigned long &cmd-body + header-size - sizeofsuffix without checking that header-size is large enough to contain both cmd-body an...

UBUNTU-CVE-2026-74499

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidiakaioutput sndusbmidiakaioutput computes its fill-loop bound bufend = ep-maxtransfer - MAXAKAISYSEXLEN - 1; as a signed int, so a small device-advertised bulk-OUT maxtransfer makes bufe...

UBUNTU-CVE-2026-74467

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAPNETADMIN for private ioctls Gate the SIOCDEVPRIVATE ioctl commands SIOCQETHADPSETSNMPCONTROL, SIOCQETHGETCARDTYPE and SIOCQETHQUERYOAT with CAPNETADMIN capable check to ensure unprivileged users cannot invoke...

UBUNTU-CVE-2026-74474

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB keys...

UBUNTU-CVE-2026-74527

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Block VFs from clobbering special CGX PKIND state PF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND programming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must not reset the LMAC ...

UBUNTU-CVE-2026-74496

In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in foucreate foucreate publishes struct fou through skuserdata before adding the new FOU port to the per-netns list. If fouaddtoportlist fails, the error path frees fou while it is still reachable through...

UBUNTU-CVE-2026-74471

In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of registerevent in tracemoduleaddevents tracemoduleaddevents ignores the return value of registerevent and unconditionally calls addeventtotracers for each event. If registerevent fails for example, i...

UBUNTU-CVE-2026-74528

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hcipastsync callback Avoids giving freed pointers to hciconnvalid, which kmalloc may have reused. Hold refcount to avoid that...

UBUNTU-CVE-2026-74512

In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in auditdelrule auditdelrule destroys e-rule.exe via auditremovemarkrule before unlinking the rule from RCU-visible filter lists and waiting for a grace period. Concurrent readers in auditfilte...

UBUNTU-CVE-2026-74449

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculatemcachesetting on zero viewport If a plane reaches calculatemcachesetting with a zero-area viewport, calculatemcachesetting exits early with nummcaches == 0 and mvmpgwidth/height == ...